GHSA-46q3-7gv7-qmgg CVE-2026-47242
Net::IMAP: Command Injection via ID command argument
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.18%
- Chance of exploitation in the next 30 days. Higher than 7.96% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- Fix
0.6.4.1- Upgrade net-imap to this version or later
Description
Summary
Two Net::IMAP commands, #id and #enable, do not validate their arguments. Arguments to either command could be used by an attacker to inject arbitrary IMAP commands.
Please note that passing untrusted inputs to these commands is usually inappropriate and expected to be uncommon.
Details
When Net::IMAP#id is called with a hash argument, although the ID field value strings are correctly quoted (escaping quoted specials), they were not validated to prohibit CRLF sequences.
While Net::IMAP#enable does process its arguments for aliases, it does not validate them as valid atoms (or as a list of valid atoms). The #to_s value is sent verbatim.
Impact
This is expected to impact very few users: use of untrusted user input for either command is expected to be very uncommon.
The documentation for #enable explicitly warns that using any arguments that are not in the explicitly supported list may result in undocumented behavior. Using arbitrary untrusted user input for #enable will always be inappropriate.
Although client ID field values will most commonly be static and hardcoded, dynamic input sources may be used. For example, client ID fields may be set by configuration or version numbers. Using untrusted user inputs for client ID fields is expected to be uncommon. But any untrusted inputs to client ID can trivially exploit this vulnerability.
Untrusted inputs to either command may include a CRLF sequence followed by a new IMAP command (like DELETE mailbox). Although this does not directly enable data exfiltration, it could be combined with other attack vectors or knowledge of the target system's attributes, e.g.: shared mail folders or the application's installed response handlers.
Mitigation
Update to a version of net-imap which validates #id and #enable arguments.
Untrusted inputs should never be used for #enable arguments.
If net-imap cannot be upgraded:
- do not use untrusted inputs for client ID field values
- or add validation that client ID field values must not contain any CR or LF bytes.
Affected versions
RubyGems
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
net-imap RubyGems → 0.6.4.1
- bundler
bundle update net-imap # Gemfile: gem "net-imap", ">= 0.6.4.1"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
How to prevent it
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
How to prevent it
- Implementation: Avoid using CRLF as a special sequence.
- Implementation: Appropriately filter or quote CRLF sequences in user-controlled input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c4fp-cxrr-mj66 Net::IMAP: Denial of Service via incomplete raw argument validation | Low | Also affects net-imap |
| GHSA-8p34-64r3-mwg8 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument | Medium | Also affects net-imap |
| GHSA-hm49-wcqc-g2xg net-imap vulnerable to command Injection via "raw" arguments to multiple commands | Critical | Also affects net-imap |
| GHSA-75xq-5h9v-w6px net-imap vulnerable to command Injection via unvalidated Symbol inputs | Medium | Also affects net-imap |
| GHSA-87pf-fpwv-p7m7 net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication | Medium | Also affects net-imap |
| GHSA-q2mw-fvj9-vvcw net-imap has quadratic complexity when reading response literals | High | Also affects net-imap |
| GHSA-vcgp-9326-pqcp net-imap vulnerable to STARTTLS stripping via invalid response timing | High | Also affects net-imap |
| GHSA-j3g3-5qv5-52mj net-imap rubygem vulnerable to possible DoS by memory exhaustion | Medium | Also affects net-imap |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor